Branch was auto-updated.

data_sources/linux_auditd_add_user.yml

@@ -6,6 +6,7 @@ author: Teoderick Contreras, Splunk
 description: Data source object for Linux Auditd Add User Type
 source: /var/log/audit/audit.log
 sourcetype: linux:audit
+configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
 supported_TA:
 - name: Splunk Add-on for Unix and Linux
   url: https://splunkbase.splunk.com/app/833

data_sources/linux_auditd_execve.yml

@@ -6,6 +6,7 @@ author: Teoderick Contreras, Splunk
 description: Data source object for Linux Auditd Execve Type
 source: /var/log/audit/audit.log
 sourcetype: linux:audit
+configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
 supported_TA:
 - name: Splunk Add-on for Unix and Linux
   url: https://splunkbase.splunk.com/app/833

data_sources/linux_auditd_path.yml

@@ -6,6 +6,7 @@ author: Teoderick Contreras, Splunk
 description: Data source object for Linux Auditd Path Type
 source: /var/log/audit/audit.log
 sourcetype: linux:audit
+configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
 supported_TA:
 - name: Splunk Add-on for Unix and Linux
   url: https://splunkbase.splunk.com/app/833

data_sources/linux_auditd_proctitle.yml

@@ -6,6 +6,7 @@ author: Teoderick Contreras, Splunk
 description: Data source object for Linux Auditd Proctitle Type
 source: /var/log/audit/audit.log
 sourcetype: linux:audit
+configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
 supported_TA:
 - name: Splunk Add-on for Unix and Linux
   url: https://splunkbase.splunk.com/app/833

data_sources/linux_auditd_service_stop.yml

@@ -6,6 +6,7 @@ author: Teoderick Contreras, Splunk
 description: Data source object for Linux Auditd Service Stop Type
 source: /var/log/audit/audit.log
 sourcetype: linux:audit
+configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
 supported_TA:
 - name: Splunk Add-on for Unix and Linux
   url: https://splunkbase.splunk.com/app/833

data_sources/linux_auditd_syscall.yml

@@ -6,6 +6,7 @@ author: Teoderick Contreras, Splunk
 description: Data source object for Linux Auditd Syscall Type
 source: /var/log/audit/audit.log
 sourcetype: linux:audit
+configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules
 supported_TA:
 - name: Splunk Add-on for Unix and Linux
   url: https://splunkbase.splunk.com/app/833

detections/endpoint/known_services_killed_by_ransomware.yml

@@ -1,7 +1,7 @@
 name: Known Services Killed by Ransomware
 id: 3070f8e0-c528-11eb-b2a0-acde48001122
-version: '6'
-date: '2024-11-28'
+version: 7
+date: '2024-12-09'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -18,8 +18,8 @@ data_source:
 search: '`wineventlog_system` EventCode=7036 param1 IN ("*Volume Shadow Copy*","*VSS*",
   "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*", "DefWatch",
   "ccEvtMgr", "ccSetMgr", "SavRoam", "RTVscan", "QBFCService", "QBIDPService", "Intuit.QuickBooks.FCS",
-  "QBCFMonitorService" "YooBackup", "YooIT", "*Veeam*", "PDVFSService", "BackupExecVSSProvider",
-  "BackupExecAgentAccelerator", "BackupExec*", "WdBoot", "WdFilter", "WdNisDrv", "WdNisSvc",
+  "QBCFMonitorService", "YooBackup", "YooIT", "*Veeam*", "PDVFSService", "BackupExec*",
+  "WdBoot", "WdFilter", "WdNisDrv", "WdNisSvc",
   "WinDefend", "wscsvc", "Sense", "sppsvc", "SecurityHealthService") param2="stopped"
   | stats count min(_time) as firstTime max(_time) as lastTime by EventCode param1
   dest | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`